DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware | Not Hacker News!